Data Retention and Investigatory Powers Act 2014

(Redirected from DRIPA)

Data Retention and Investigatory Powers Act 2014 (DRIP) is an "emergency" act presented by the government in July 2014 following the change in legal status of the implementation of the Data Retention Directive.

The act amends the Regulation of Investigatory Powers Act 2000.

The provisions in the Act are expected to be replaced by the Investigatory Powers Bill before the end of 2016.

Announcement of the Bill

The Bill was announced by the Home Secretary, Theresa May MP on Thursday 10 July 2014 in the House of Commons [1] . She said

"I want to propose... a narrow and limited response to a set of specific challenges we face. I am not proposing the introduction of the Communications Data Bill"
"So I can tell the House that today the Government are announcing the introduction of fast-track legislation, through the data retention and investigatory powers Bill"[2].

She said that while the European Court of Justice ruled the Data Retention Directive incompatible with human rights, they did not take into consideration domestic legislation that provides safeguards and guarantees. She said such laws were contained in the Regulation of Investigatory Powers Act 2000, as it was designed to comply with the European Convention on Human Rights[3].

Political responses

ORG's Initial Views

  • The retention period is still 12 months however this is a maximum period and will be adjusted according to the type of retention required, but without seeing a notice there is no way of knowing on what basis the retention period will be adjusted and how frequently it will be lower than 12 months.
  • There is now a wider scope to include operators of Tor services as well as any webmail services that process data in the UK
  • In regards to the sunset clause, these have been extended in the past and it is not clear that there is anything stopping this happening again.
  • Other EU countries such as Germany have not replaced this legislation after the original Directive was struck down, Germany has not fallen prey to repeated terrorist attacks. In our view this suggests that the "emergency" nature of the situation has been exaggerated.

Parliamentary process

As emergency legislation an accelerated timeline enabled it to be pushed through in a week:

Compatibility with European directives

On July 17th the Department of Business, Innovation and Skills informed[5] the European Commission TRIS that the UK does not consider that the new act require notification per the Privacy and Electronic Communications Directive.

Judicial Review

On the 22nd of July intention to seek a Judicial Review of the Act was announced by Liberty working on behalf of Tom Watson MP and David Davis MP. [6] Open Rights Group and Privacy International also made interventions.

The High Court ruling, given 17 July 2015, found that sections 1 and 2 of the act were incompatible with ECHR articles 7 and 8.[7]





Letters to MPs